@eamonboyle/mssql-mcp 1.6.0 → 2.0.0

package/dist/validation.js

@@ -1,11 +1,24 @@
 /**
  * SQL query validation for read-only operations.
- * Extracted for testability and reuse.
+ *
+ * The query is tokenized following T-SQL lexing rules (string literals,
+ * quoted identifiers, nested comments, numeric/hex/money literals, CR or LF
+ * line endings) so checks compare whole tokens. This matters because SQL
+ * Server splits `1COMMIT` into `1` and `COMMIT` and runs consecutive
+ * statements without a separating semicolon; regex word boundaries miss both.
+ *
+ * Validation is one layer: read_data also runs every query inside a
+ * transaction that is always rolled back, and a least-privilege login remains
+ * the primary control.
  */
-const DANGEROUS_KEYWORDS = [
+const MAX_QUERY_LENGTH = 10000;
+/** Words that never appear in a single read-only SELECT. */
+const DANGEROUS_KEYWORDS = new Set([
     "DELETE",
     "DROP",
     "UPDATE",
+    "UPDATETEXT",
+    "WRITETEXT",
     "INSERT",
     "ALTER",
     "CREATE",
@@ -13,121 +26,260 @@ const DANGEROUS_KEYWORDS = [
     "EXEC",
     "EXECUTE",
     "MERGE",
-    "REPLACE",
     "GRANT",
     "REVOKE",
+    "DENY",
     "COMMIT",
     "ROLLBACK",
+    "SAVE",
     "TRANSACTION",
+    "TRAN",
     "BEGIN",
     "DECLARE",
     "SET",
+    "SETUSER",
+    "REVERT",
     "USE",
     "BACKUP",
     "RESTORE",
     "KILL",
     "SHUTDOWN",
+    "CHECKPOINT",
+    "RECONFIGURE",
+    "DBCC",
     "WAITFOR",
+    "RECEIVE",
+    "SEND",
+    "MOVE",
+    "WHILE",
+    "IF",
+    "GOTO",
+    "RAISERROR",
+    "THROW",
+    "PRINT",
     "OPENROWSET",
     "OPENDATASOURCE",
     "OPENQUERY",
     "OPENXML",
     "BULK",
     "INTO",
-];
-const DANGEROUS_PATTERNS = [
-    /SELECT\s+.*?\s+INTO\s+/i,
-    /;\s*(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE|MERGE|REPLACE|GRANT|REVOKE)/i,
-    /UNION\s+(?:ALL\s+)?SELECT.*?(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE)/i,
-    /--.*?(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE)/i,
-    /\/\*.*?(DELETE|DROP|UPDATE|INSERT|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE).*?\*\//i,
-    /EXEC\s*\(/i,
-    /EXECUTE\s*\(/i,
-    /sp_/i,
-    /xp_/i,
-    /BULK\s+INSERT/i,
-    /OPENROWSET/i,
-    /OPENDATASOURCE/i,
-    /@@/,
-    /SYSTEM_USER/i,
-    /USER_NAME/i,
-    /DB_NAME/i,
-    /HOST_NAME/i,
-    /WAITFOR\s+DELAY/i,
-    /WAITFOR\s+TIME/i,
-    /;\s*\w/,
-    /\+\s*CHAR\s*\(/i,
-    /\+\s*NCHAR\s*\(/i,
-    /\+\s*ASCII\s*\(/i,
-];
+]);
+/** Functions that disclose login or host identity. */
+const IDENTITY_FUNCTIONS = new Set([
+    "USER_NAME",
+    "SUSER_NAME",
+    "SUSER_SNAME",
+    "HOST_NAME",
+    "ORIGINAL_LOGIN",
+]);
+/** Words that may directly precede an additional top-level SELECT. */
+const SET_OPERATORS = new Set(["UNION", "ALL", "EXCEPT", "INTERSECT"]);
+const WORD_START = /[\p{L}_@#]/u;
+const WORD_PART = /[\p{L}\p{N}_@#$]/u;
+const DIGIT = /[0-9]/;
+const HEX_DIGIT = /[0-9A-Fa-f]/;
+function isLineBreak(char) {
+    return char === "\n" || char === "\r";
+}
 /**
- * Validates a SQL query for read-only (SELECT) operations.
- * Rejects dangerous keywords, injection patterns, and multi-statement queries.
+ * Splits a query into T-SQL tokens. Comments and whitespace are dropped.
+ * Returns null when a string literal, quoted identifier, or block comment is
+ * left unterminated.
+ */
+export function tokenizeSql(query) {
+    const tokens = [];
+    let index = 0;
+    const readNumber = () => {
+        const start = index;
+        if (query[index] === "0" && /[xX]/.test(query[index + 1] ?? "")) {
+            index += 2;
+            while (HEX_DIGIT.test(query[index] ?? ""))
+                index += 1;
+            return query.slice(start, index);
+        }
+        while (DIGIT.test(query[index] ?? ""))
+            index += 1;
+        if (query[index] === ".") {
+            index += 1;
+            while (DIGIT.test(query[index] ?? ""))
+                index += 1;
+        }
+        if (/[eE]/.test(query[index] ?? "") &&
+            (DIGIT.test(query[index + 1] ?? "") ||
+                (/[+-]/.test(query[index + 1] ?? "") &&
+                    DIGIT.test(query[index + 2] ?? "")))) {
+            index += 2;
+            while (DIGIT.test(query[index] ?? ""))
+                index += 1;
+        }
+        return query.slice(start, index);
+    };
+    while (index < query.length) {
+        const char = query[index];
+        const next = query[index + 1];
+        if (/\s/.test(char)) {
+            index += 1;
+            continue;
+        }
+        // Line comments end at CR or LF: SQL Server treats a bare CR as a break.
+        if (char === "-" && next === "-") {
+            while (index < query.length && !isLineBreak(query[index]))
+                index += 1;
+            continue;
+        }
+        if (char === "/" && next === "*") {
+            // T-SQL block comments nest.
+            let depth = 1;
+            index += 2;
+            while (index < query.length && depth > 0) {
+                if (query[index] === "/" && query[index + 1] === "*") {
+                    depth += 1;
+                    index += 2;
+                }
+                else if (query[index] === "*" && query[index + 1] === "/") {
+                    depth -= 1;
+                    index += 2;
+                }
+                else {
+                    index += 1;
+                }
+            }
+            if (depth > 0)
+                return null;
+            continue;
+        }
+        if (char === "'" || char === '"' || char === "[") {
+            const close = char === "[" ? "]" : char;
+            const start = index;
+            index += 1;
+            let terminated = false;
+            while (index < query.length) {
+                if (query[index] === close) {
+                    // Doubled delimiters ('' or ]] or "") escape the delimiter.
+                    if (query[index + 1] === close) {
+                        index += 2;
+                        continue;
+                    }
+                    index += 1;
+                    terminated = true;
+                    break;
+                }
+                index += 1;
+            }
+            if (!terminated)
+                return null;
+            tokens.push({
+                type: char === "'" ? "string" : "identifier",
+                value: query.slice(start, index),
+            });
+            continue;
+        }
+        if (DIGIT.test(char) || (char === "." && DIGIT.test(next ?? ""))) {
+            tokens.push({ type: "number", value: readNumber() });
+            continue;
+        }
+        // Money literal such as $5 or $.5.
+        if (char === "$" &&
+            (DIGIT.test(next ?? "") ||
+                (next === "." && DIGIT.test(query[index + 2] ?? "")))) {
+            index += 1;
+            tokens.push({ type: "number", value: `$${readNumber()}` });
+            continue;
+        }
+        if (WORD_START.test(char) ||
+            (char === "$" && WORD_START.test(next ?? ""))) {
+            const start = index;
+            index += 1;
+            while (index < query.length && WORD_PART.test(query[index]))
+                index += 1;
+            tokens.push({
+                type: "word",
+                value: query.slice(start, index).toUpperCase(),
+            });
+            continue;
+        }
+        tokens.push({ type: "punct", value: char });
+        index += 1;
+    }
+    return tokens;
+}
+function invalid(error) {
+    return { isValid: false, error };
+}
+const MALICIOUS_PATTERN_ERROR = "Potentially malicious SQL pattern detected. Only simple SELECT queries are allowed.";
+/**
+ * Validates a SQL query for read-only use: exactly one SELECT statement,
+ * optionally preceded by common table expressions and combined with
+ * UNION/EXCEPT/INTERSECT.
  */
 export function validateReadQuery(query) {
     if (!query || typeof query !== "string") {
-        return {
-            isValid: false,
-            error: "Query must be a non-empty string",
-        };
+        return invalid("Query must be a non-empty string");
     }
-    const cleanQuery = query
-        .replace(/--.*$/gm, "")
-        .replace(/\/\*[\s\S]*?\*\//g, "")
-        .replace(/\s+/g, " ")
-        .trim();
-    if (!cleanQuery) {
-        return {
-            isValid: false,
-            error: "Query cannot be empty after removing comments",
-        };
+    if (query.length > MAX_QUERY_LENGTH) {
+        return invalid("Query is too long. Maximum allowed length is 10,000 characters.");
     }
-    const upperQuery = cleanQuery.toUpperCase();
-    if (!upperQuery.startsWith("SELECT")) {
-        return {
-            isValid: false,
-            error: "Query must start with SELECT for security reasons",
-        };
+    const tokens = tokenizeSql(query);
+    if (tokens === null) {
+        return invalid("Query contains an unterminated string literal, quoted identifier, or comment.");
     }
-    for (const keyword of DANGEROUS_KEYWORDS) {
-        const keywordRegex = new RegExp(`(^|\\s|[^A-Za-z0-9_])${keyword}($|\\s|[^A-Za-z0-9_])`, "i");
-        if (keywordRegex.test(upperQuery)) {
-            return {
-                isValid: false,
-                error: `Dangerous keyword '${keyword}' detected in query. Only SELECT operations are allowed.`,
-            };
-        }
+    // Leading and trailing semicolons are harmless (";WITH ..." style, "...;").
+    let start = 0;
+    let end = tokens.length;
+    while (start < end && tokens[start].value === ";")
+        start += 1;
+    while (end > start && tokens[end - 1].value === ";")
+        end -= 1;
+    const body = tokens.slice(start, end);
+    if (body.length === 0) {
+        return invalid("Query cannot be empty after removing comments");
+    }
+    if (body[0].type !== "word" || !["SELECT", "WITH"].includes(body[0].value)) {
+        return invalid("Query must start with SELECT (or WITH for a CTE)");
     }
-    for (const pattern of DANGEROUS_PATTERNS) {
-        if (pattern.test(query)) {
-            return {
-                isValid: false,
-                error: "Potentially malicious SQL pattern detected. Only simple SELECT queries are allowed.",
-            };
+    for (const [position, token] of body.entries()) {
+        if (token.type !== "word")
+            continue;
+        if (DANGEROUS_KEYWORDS.has(token.value)) {
+            return invalid(`Dangerous keyword '${token.value}' detected in query. Only SELECT operations are allowed.`);
+        }
+        const following = body[position + 1];
+        if (token.value.startsWith("@@") ||
+            token.value.startsWith("SP_") ||
+            token.value.startsWith("XP_") ||
+            token.value === "SYSTEM_USER" ||
+            (IDENTITY_FUNCTIONS.has(token.value) && following?.value === "(") ||
+            ((token.value === "ENABLE" || token.value === "DISABLE") &&
+                following?.value === "TRIGGER") ||
+            ((token.value === "END" || token.value === "GET") &&
+                following?.value === "CONVERSATION")) {
+            return invalid(MALICIOUS_PATTERN_ERROR);
         }
     }
-    const statements = cleanQuery
-        .split(";")
-        .filter((stmt) => stmt.trim().length > 0);
-    if (statements.length > 1) {
-        return {
-            isValid: false,
-            error: "Multiple SQL statements are not allowed. Use only a single SELECT statement.",
-        };
+    if (body.some((token) => token.value === ";")) {
+        return invalid("Multiple SQL statements are not allowed. Use only a single SELECT statement.");
     }
-    if (query.includes("CHAR(") ||
-        query.includes("NCHAR(") ||
-        query.includes("ASCII(")) {
-        return {
-            isValid: false,
-            error: "Character conversion functions are not allowed as they may be used for obfuscation.",
-        };
+    // SQL Server runs consecutive statements without a separating semicolon,
+    // so count top-level SELECTs that are not arms of a set operation.
+    let depth = 0;
+    let statementSelects = 0;
+    for (const [position, token] of body.entries()) {
+        if (token.value === "(")
+            depth += 1;
+        else if (token.value === ")")
+            depth -= 1;
+        else if (token.type === "word" && token.value === "SELECT" && depth === 0) {
+            const previous = body[position - 1];
+            if (!previous || !SET_OPERATORS.has(previous.value)) {
+                statementSelects += 1;
+            }
+        }
+        if (depth < 0) {
+            return invalid("Query has unbalanced parentheses.");
+        }
     }
-    if (query.length > 10000) {
-        return {
-            isValid: false,
-            error: "Query is too long. Maximum allowed length is 10,000 characters.",
-        };
+    if (statementSelects !== 1) {
+        return invalid("Multiple SQL statements are not allowed. Use only a single SELECT statement.");
     }
     return { isValid: true };
 }

package/dist/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,UAAU;IACV,MAAM;IACN,SAAS;IACT,OAAO;IACP,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,aAAa;IACb,OAAO;IACP,SAAS;IACT,KAAK;IACL,KAAK;IACL,QAAQ;IACR,SAAS;IACT,MAAM;IACN,UAAU;IACV,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,WAAW;IACX,SAAS;IACT,MAAM;IACN,MAAM;CACP,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB,yBAAyB;IACzB,gGAAgG;IAChG,6FAA6F;IAC7F,sEAAsE;IACtE,+EAA+E;IAC/E,YAAY;IACZ,eAAe;IACf,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,IAAI;IACJ,cAAc;IACd,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,kBAAkB;IAClB,iBAAiB;IACjB,QAAQ;IACR,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;CACnB,CAAC;AAOF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,kCAAkC;SAC1C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK;SACrB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IAEV,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+CAA+C;SACvD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IAE5C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,mDAAmD;SAC3D,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,wBAAwB,OAAO,uBAAuB,EACtD,GAAG,CACJ,CAAC;QACF,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,sBAAsB,OAAO,0DAA0D;aAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EACH,qFAAqF;aACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,UAAU;SAC1B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EACH,8EAA8E;SACjF,CAAC;IACJ,CAAC;IAED,IACE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACxB,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EACH,qFAAqF;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,iEAAiE;SACzE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,4DAA4D;AAC5D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,UAAU;IACV,MAAM;IACN,SAAS;IACT,OAAO;IACP,OAAO;IACP,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,UAAU;IACV,MAAM;IACN,aAAa;IACb,MAAM;IACN,OAAO;IACP,SAAS;IACT,KAAK;IACL,SAAS;IACT,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,aAAa;IACb,MAAM;IACN,SAAS;IACT,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,IAAI;IACJ,MAAM;IACN,WAAW;IACX,OAAO;IACP,OAAO;IACP,YAAY;IACZ,gBAAgB;IAChB,WAAW;IACX,SAAS;IACT,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,sDAAsD;AACtD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,WAAW;IACX,YAAY;IACZ,aAAa;IACb,WAAW;IACX,gBAAgB;CACjB,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAevE,MAAM,UAAU,GAAG,aAAa,CAAC;AACjC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,KAAK,GAAG,OAAO,CAAC;AACtB,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,SAAS,WAAW,CAAC,IAAwB;IAC3C,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,MAAM,KAAK,GAAG,KAAK,CAAC;QACpB,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;YACtD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACzB,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;oBAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EACxC,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAE9B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,6BAA6B;YAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACzC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACrD,KAAK,IAAI,CAAC,CAAC;oBACX,KAAK,IAAI,CAAC,CAAC;gBACb,CAAC;qBAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC5D,KAAK,IAAI,CAAC,CAAC;oBACX,KAAK,IAAI,CAAC,CAAC;gBACb,CAAC;qBAAM,CAAC;oBACN,KAAK,IAAI,CAAC,CAAC;gBACb,CAAC;YACH,CAAC;YACD,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;oBAC3B,4DAA4D;oBAC5D,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;wBAC/B,KAAK,IAAI,CAAC,CAAC;wBACX,SAAS;oBACX,CAAC;oBACD,KAAK,IAAI,CAAC,CAAC;oBACX,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBAC5C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;aACjC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QAED,mCAAmC;QACnC,IACE,IAAI,KAAK,GAAG;YACZ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EACvD,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QAED,IACE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YACrB,CAAC,IAAI,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAC7C,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE;aAC/C,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,uBAAuB,GAC3B,qFAAqF,CAAC;AAExF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACpC,OAAO,OAAO,CACZ,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,OAAO,CACZ,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,OAAO,KAAK,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,GAAG;QAAE,KAAK,IAAI,CAAC,CAAC;IAC9D,OAAO,GAAG,GAAG,KAAK,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG;QAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,+CAA+C,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,OAAO,CAAC,kDAAkD,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACpC,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,OAAO,CACZ,sBAAsB,KAAK,CAAC,KAAK,0DAA0D,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QACrC,IACE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAC5B,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAC7B,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAC7B,KAAK,CAAC,KAAK,KAAK,aAAa;YAC7B,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,KAAK,KAAK,GAAG,CAAC;YACjE,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;gBACtD,SAAS,EAAE,KAAK,KAAK,SAAS,CAAC;YACjC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC;gBAC/C,SAAS,EAAE,KAAK,KAAK,cAAc,CAAC,EACtC,CAAC;YACD,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,OAAO,CACZ,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC/B,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACpC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpD,gBAAgB,IAAI,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO,OAAO,CAAC,mCAAmC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CACZ,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eamonboyle/mssql-mcp",
-  "version": "1.6.0",
+  "version": "2.0.0",
   "description": "MCP server for Microsoft SQL Server - query and manage your database with natural language in Cursor, Claude, and VS Code",
   "keywords": [
     "mcp",
@@ -30,45 +30,52 @@
     "mssql-mcp": "dist/index.js"
   },
   "scripts": {
-    "build": "shx rm -rf dist && tsc && shx chmod +x dist/*.js",
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc && node -e \"require('fs').chmodSync('dist/index.js',0o755)\"",
     "prepare": "npm run build",
     "watch": "tsc --watch",
     "start": "node dist/index.js",
     "test": "vitest run",
     "test:watch": "vitest",
-    "lint": "eslint src",
-    "format": "prettier --write src",
-    "docs:check-install-links": "node scripts/generate-install-links.mjs --check",
-    "docs:update-install-links": "node scripts/generate-install-links.mjs",
+    "lint": "eslint src",
+    "format": "prettier --write src",
+    "docs:check-install-links": "node scripts/generate-install-links.mjs --check",
+    "docs:update-install-links": "node scripts/generate-install-links.mjs",
     "db:up": "bash scripts/mssql-up.sh",
     "db:down": "bash scripts/mssql-down.sh",
     "db:seed": "bash scripts/mssql-seed.sh",
     "db:reset": "bash scripts/mssql-down.sh --volumes && bash scripts/mssql-up.sh",
-    "test:e2e": "bash scripts/e2e-mcp-tools.sh"
+    "test:e2e": "bash scripts/e2e-mcp-tools.sh && node scripts/e2e-protocol.mjs",
+    "test:e2e:protocol": "node scripts/e2e-protocol.mjs"
   },
   "files": [
     "dist"
   ],
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.0.0"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.2",
-    "@types/mssql": "^9.1.7",
-    "@types/node": "^20.0.0",
-    "eslint": "^9.39.2",
+    "@eslint/js": "^10.0.1",
+    "@modelcontextprotocol/client": "^2.3.1",
+    "@types/mssql": "^12.3.0",
+    "@types/node": "^22.20.5",
+    "eslint": "^10.12.0",
     "eslint-config-prettier": "^10.1.8",
-    "prettier": "^3.8.1",
-    "shx": "^0.3.4",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.55.0",
-    "vitest": "^4.1.10"
+    "prettier": "^3.9.10",
+    "sprintf-js": "file:vendor/sprintf-js",
+    "typescript": "~6.0.3",
+    "typescript-eslint": "^8.71.1",
+    "vitest": "^5.0.3"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.28.0",
-    "dotenv": "^10.0.0",
-    "mssql": "^11.0.1",
-    "zod": "^4.3.6"
+    "@modelcontextprotocol/ext-apps": "^2.0.3",
+    "@modelcontextprotocol/node": "^2.1.1",
+    "@modelcontextprotocol/server": "^2.3.1",
+    "dotenv": "^18.0.7",
+    "mssql": "^12.7.4",
+    "zod": "^4.6.5"
   },
-  "type": "module"
+  "type": "module",
+  "overrides": {
+    "sprintf-js": "$sprintf-js"
+  }
 }